co-maintainer 0.4.0-beta.1

package/dist/src/remote/server/routes.js

@@ -0,0 +1,150 @@
+import { VERSION } from "../../version.js";
+import { cloneDir, readConfig } from "../../config.js";
+import { resolveDefaultBranchName } from "../../git/default_branch.js";
+import { runCommand } from "../../pr/checkout.js";
+import { loadGuides } from "../../review/guides.js";
+import { isLockedOut, readBearerToken, recordAuthFailure, } from "../../server/auth.js";
+import { errorResponse } from "../../server/errors.js";
+import { lookupRemoteBearer } from "../../services/remote_tokens.js";
+import { findRepoByFullName } from "../../store/repos.js";
+import { MIN_CLIENT_SCHEMA, REMOTE_CLI_UPGRADE_COMMAND, REMOTE_MAX_BODY_BYTES, REMOTE_SCHEMA_VERSION, REMOTE_SYNC_INTERVAL_SECONDS, } from "../schema.js";
+import { readBoundedJson } from "./body.js";
+import { submitRemoteReview } from "../../services/remote_review.js";
+import { handleRemoteCancel, handleRemoteSync } from "./sync.js";
+import { validateHandshakeRequest, validateSubmitRequest, } from "../validate.js";
+import { stat } from "../../util/runtime.js";
+const REPO_UNAVAILABLE = "Sorry, we could not access this repository.";
+async function authenticateRemote(request, ip) {
+    if (isLockedOut(ip)) {
+        return errorResponse(429, "locked_out", "too many failed attempts");
+    }
+    const bearer = readBearerToken(request);
+    if (!bearer) {
+        recordAuthFailure(ip);
+        return errorResponse(401, "token_invalid", "invalid or missing token");
+    }
+    const status = await lookupRemoteBearer(bearer);
+    if (status === "invalid") {
+        recordAuthFailure(ip);
+        return errorResponse(401, "token_invalid", "invalid or missing token");
+    }
+    if (status === "inactive") {
+        return errorResponse(403, "token_inactive", "token is inactive");
+    }
+    return status;
+}
+async function defaultBranchForRepo(fullName) {
+    try {
+        const dir = cloneDir(fullName);
+        await stat(dir);
+        const name = await resolveDefaultBranchName(dir, "origin", runCommand);
+        return name ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function handleHandshake(request, ip) {
+    const parsed = await readBoundedJson(request, REMOTE_MAX_BODY_BYTES);
+    if (!parsed.ok) {
+        return errorResponse(parsed.status, parsed.code, parsed.message);
+    }
+    const validation = validateHandshakeRequest(parsed.value);
+    if (validation) {
+        return errorResponse(400, "bad_request", validation);
+    }
+    const record = parsed.value;
+    const schemaVersion = record.schemaVersion;
+    if (schemaVersion < MIN_CLIENT_SCHEMA) {
+        return errorResponse(426, "upgrade_required", "This co-maintainer CLI is too old for the server.", {
+            minClientSchema: MIN_CLIENT_SCHEMA,
+            serverSchema: REMOTE_SCHEMA_VERSION,
+            upgradeCommand: REMOTE_CLI_UPGRADE_COMMAND,
+        });
+    }
+    const auth = await authenticateRemote(request, ip);
+    if (auth instanceof Response)
+        return auth;
+    const repoRow = findRepoByFullName(String(record.repo));
+    if (!repoRow || repoRow.active !== 1) {
+        return errorResponse(404, "repo_unavailable", REPO_UNAVAILABLE);
+    }
+    const guides = await loadGuides(repoRow.full_name);
+    if (!guides.shortGuide && !guides.skill) {
+        return errorResponse(409, "not_initialized", REPO_UNAVAILABLE);
+    }
+    const config = readConfig();
+    const timeoutSeconds = config.remoteSyncTimeoutSeconds ?? 10;
+    const toolLimit = config.remoteToolOutputMaxChars ?? null;
+    return Response.json({
+        schemaVersion: REMOTE_SCHEMA_VERSION,
+        minClientSchema: MIN_CLIENT_SCHEMA,
+        serverVersion: VERSION,
+        token: { name: auth.name },
+        repo: {
+            fullName: repoRow.full_name,
+            defaultBranch: await defaultBranchForRepo(repoRow.full_name),
+            guideBuiltAt: guides.guideBuiltAt,
+        },
+        sync: {
+            intervalSeconds: REMOTE_SYNC_INTERVAL_SECONDS,
+            timeoutSeconds,
+        },
+        limits: {
+            maxBodyBytes: REMOTE_MAX_BODY_BYTES,
+            toolOutputMaxChars: toolLimit,
+        },
+    });
+}
+async function handleSync(request, ip, jobId) {
+    const auth = await authenticateRemote(request, ip);
+    if (auth instanceof Response)
+        return auth;
+    const parsed = await readBoundedJson(request, REMOTE_MAX_BODY_BYTES);
+    if (!parsed.ok) {
+        return errorResponse(parsed.status, parsed.code, parsed.message);
+    }
+    return handleRemoteSync(jobId, auth, parsed.value);
+}
+async function handleSubmit(request, ip) {
+    const auth = await authenticateRemote(request, ip);
+    if (auth instanceof Response)
+        return auth;
+    const parsed = await readBoundedJson(request, REMOTE_MAX_BODY_BYTES);
+    if (!parsed.ok) {
+        return errorResponse(parsed.status, parsed.code, parsed.message);
+    }
+    const validation = validateSubmitRequest(parsed.value);
+    if (validation) {
+        return errorResponse(400, "bad_request", validation);
+    }
+    const result = submitRemoteReview(auth, parsed.value);
+    if ("error" in result) {
+        return errorResponse(result.status, result.code, result.error);
+    }
+    return Response.json({
+        schemaVersion: REMOTE_SCHEMA_VERSION,
+        jobId: result.jobId,
+        reviewId: result.reviewId,
+    }, { status: 202 });
+}
+export async function handleRemoteRoute(request, url, remoteAddr) {
+    if (url.pathname === "/api/remote/handshake" && request.method === "POST") {
+        return await handleHandshake(request, remoteAddr);
+    }
+    if (url.pathname === "/api/remote/reviews" && request.method === "POST") {
+        return await handleSubmit(request, remoteAddr);
+    }
+    const syncMatch = /^\/api\/remote\/reviews\/([^/]+)\/sync$/.exec(url.pathname);
+    if (syncMatch && request.method === "POST") {
+        return await handleSync(request, remoteAddr, syncMatch[1]);
+    }
+    const reviewMatch = /^\/api\/remote\/reviews\/([^/]+)$/.exec(url.pathname);
+    if (reviewMatch && request.method === "DELETE") {
+        const auth = await authenticateRemote(request, remoteAddr);
+        if (auth instanceof Response)
+            return auth;
+        return handleRemoteCancel(reviewMatch[1], auth);
+    }
+    return errorResponse(404, "not_found", `no route for ${url.pathname}`);
+}

package/dist/src/remote/server/sessions.d.ts

@@ -0,0 +1,16 @@
+export type RemoteSession = {
+    jobId: string;
+    reviewId: string;
+    tokenId: string;
+    subjectId: string;
+    lastSyncAt: number;
+};
+export type RemoteSyncResult = Record<string, unknown>;
+export declare function openRemoteSession(session: Omit<RemoteSession, "lastSyncAt">): void;
+export declare function touchRemoteSession(jobId: string): void;
+export declare function getRemoteSession(jobId: string): RemoteSession | undefined;
+export declare function closeRemoteSession(jobId: string): void;
+export declare function setRemoteSyncResult(jobId: string, result: RemoteSyncResult): void;
+export declare function getRemoteSyncResult(jobId: string): RemoteSyncResult | undefined;
+export declare function startRemoteWatchdog(): void;
+export declare function stopRemoteWatchdog(): void;

package/dist/src/remote/server/sessions.js

@@ -0,0 +1,48 @@
+import { readConfig } from "../../config.js";
+import { cancel } from "../../services/jobs.js";
+import { clearRemoteToolBridge } from "../tool_bridge.js";
+const sessions = new Map();
+const finishedResults = new Map();
+let watchdogTimer;
+export function openRemoteSession(session) {
+    sessions.set(session.jobId, { ...session, lastSyncAt: Date.now() });
+}
+export function touchRemoteSession(jobId) {
+    const session = sessions.get(jobId);
+    if (session)
+        session.lastSyncAt = Date.now();
+}
+export function getRemoteSession(jobId) {
+    return sessions.get(jobId);
+}
+export function closeRemoteSession(jobId) {
+    sessions.delete(jobId);
+    clearRemoteToolBridge(jobId);
+    setTimeout(() => finishedResults.delete(jobId), 60_000);
+}
+export function setRemoteSyncResult(jobId, result) {
+    finishedResults.set(jobId, result);
+}
+export function getRemoteSyncResult(jobId) {
+    return finishedResults.get(jobId);
+}
+export function startRemoteWatchdog() {
+    if (watchdogTimer !== undefined)
+        return;
+    watchdogTimer = setInterval(() => {
+        const timeoutMs = (readConfig().remoteSyncTimeoutSeconds ?? 10) * 1000;
+        const now = Date.now();
+        for (const [jobId, session] of sessions) {
+            if (now - session.lastSyncAt > timeoutMs) {
+                cancel(jobId, "client_timeout");
+                closeRemoteSession(jobId);
+            }
+        }
+    }, 1000);
+}
+export function stopRemoteWatchdog() {
+    if (watchdogTimer !== undefined) {
+        clearInterval(watchdogTimer);
+        watchdogTimer = undefined;
+    }
+}

package/dist/src/remote/server/sync.d.ts

@@ -0,0 +1,3 @@
+import type { RemoteTokenRow } from "../../store/rows.ts";
+export declare function handleRemoteSync(jobId: string, token: RemoteTokenRow, body: Record<string, unknown>): Response;
+export declare function handleRemoteCancel(jobId: string, token: RemoteTokenRow): Response;

package/dist/src/remote/server/sync.js

@@ -0,0 +1,90 @@
+import { cancel, getLogsSince } from "../../services/jobs.js";
+import { errorResponse } from "../../server/errors.js";
+import { redact } from "../../util/redact.js";
+import { getJob } from "../../store/jobs.js";
+import { getReviewByJobId } from "../../store/reviews.js";
+import { REMOTE_SCHEMA_VERSION } from "../schema.js";
+import { validateSyncRequest, validateSyncResponseStatus, } from "../validate.js";
+import { getRemoteSyncResult, touchRemoteSession, } from "./sessions.js";
+import { applyToolResults, drainPendingToolCalls } from "../tool_bridge.js";
+function jobToSyncStatus(jobStatus) {
+    switch (jobStatus) {
+        case "queued":
+            return "queued";
+        case "running":
+            return "running";
+        case "done":
+            return "done";
+        case "failed":
+            return "failed";
+        case "canceled":
+            return "canceled";
+        default:
+            return "failed";
+    }
+}
+export function handleRemoteSync(jobId, token, body) {
+    const validation = validateSyncRequest(body);
+    if (validation) {
+        return errorResponse(400, "bad_request", validation);
+    }
+    const job = getJob(jobId);
+    const review = getReviewByJobId(jobId);
+    if (!job || !review || review.token_id !== token.id) {
+        return errorResponse(404, "not_found", "review not found");
+    }
+    touchRemoteSession(jobId);
+    const toolResults = body.toolResults;
+    if (Array.isArray(toolResults)) {
+        applyToolResults(jobId, toolResults);
+    }
+    const afterLogSeq = Number(body.afterLogSeq);
+    const logs = getLogsSince(jobId, afterLogSeq).map((row) => ({
+        seq: row.seq,
+        at: row.at,
+        level: row.level,
+        message: row.message,
+    }));
+    const status = jobToSyncStatus(job.status);
+    const statusErr = validateSyncResponseStatus(status);
+    if (statusErr) {
+        return errorResponse(500, "internal", statusErr);
+    }
+    let abort = null;
+    let result = null;
+    if (status === "done") {
+        result = getRemoteSyncResult(jobId) ?? null;
+    }
+    else if (status === "canceled") {
+        const reason = job.cancel_reason ?? "canceled";
+        abort = {
+            reason,
+            message: reason === "client_timeout"
+                ? "No sync received for the configured timeout."
+                : "Review was canceled.",
+        };
+    }
+    else if (status === "failed") {
+        abort = {
+            reason: "failed",
+            message: redact(job.error ?? "Review failed."),
+        };
+    }
+    const toolCalls = drainPendingToolCalls(jobId);
+    return Response.json({
+        schemaVersion: REMOTE_SCHEMA_VERSION,
+        status,
+        toolCalls,
+        logs,
+        result,
+        abort,
+    });
+}
+export function handleRemoteCancel(jobId, token) {
+    const review = getReviewByJobId(jobId);
+    if (!review || review.token_id !== token.id) {
+        return errorResponse(404, "not_found", "review not found");
+    }
+    cancel(jobId, "client_canceled");
+    return new Response(null, { status: 204 });
+}

package/dist/src/remote/tool_bridge.d.ts

@@ -0,0 +1,15 @@
+import type { ToolHandler } from "../ai/mermaid_loop.ts";
+export type PendingToolCall = {
+    callId: string;
+    name: string;
+    arguments: Record<string, unknown>;
+};
+export declare function clearRemoteToolBridge(jobId: string): void;
+export declare function drainPendingToolCalls(jobId: string): PendingToolCall[];
+export declare function applyToolResults(jobId: string, results: Array<{
+    callId: string;
+    output?: string;
+    error?: string;
+}>): void;
+/** Server-side handlers: same schemas as local tools, execution on the CLI. */
+export declare function remoteBridgeToolHandlers(jobId: string, signal: AbortSignal, allowedNames: ReadonlySet<string>, sourceHandlers: ToolHandler[]): ToolHandler[];

package/dist/src/remote/tool_bridge.js

@@ -0,0 +1,84 @@
+import { readConfig } from "../config.js";
+import { REMOTE_KNOWN_TOOL_NAMES } from "./schema.js";
+const pendingByJob = new Map();
+const queuedCallsByJob = new Map();
+export function clearRemoteToolBridge(jobId) {
+    const pending = pendingByJob.get(jobId);
+    if (pending) {
+        for (const [, entry] of pending) {
+            entry.reject(new Error("review ended"));
+        }
+    }
+    pendingByJob.delete(jobId);
+    queuedCallsByJob.delete(jobId);
+}
+export function drainPendingToolCalls(jobId) {
+    const queue = queuedCallsByJob.get(jobId) ?? [];
+    queuedCallsByJob.set(jobId, []);
+    return queue;
+}
+export function applyToolResults(jobId, results) {
+    const pending = pendingByJob.get(jobId);
+    if (!pending)
+        return;
+    const maxChars = readConfig().remoteToolOutputMaxChars ?? 500_000;
+    for (const row of results) {
+        const entry = pending.get(row.callId);
+        if (!entry)
+            continue;
+        pending.delete(row.callId);
+        if (row.error !== undefined) {
+            entry.reject(new Error(row.error));
+            continue;
+        }
+        const out = row.output ?? "";
+        entry.resolve(out.length > maxChars ? `${out.slice(0, maxChars)}\n...[truncated]` : out);
+    }
+}
+function queueToolCall(jobId, signal, name, args) {
+    if (signal.aborted)
+        throw new Error("aborted");
+    const callId = crypto.randomUUID();
+    const argsObj = typeof args === "object" && args !== null && !Array.isArray(args)
+        ? args
+        : {};
+    const call = { callId, name, arguments: argsObj };
+    let queue = queuedCallsByJob.get(jobId);
+    if (!queue) {
+        queue = [];
+        queuedCallsByJob.set(jobId, queue);
+    }
+    queue.push(call);
+    return new Promise((resolve, reject) => {
+        let pending = pendingByJob.get(jobId);
+        if (!pending) {
+            pending = new Map();
+            pendingByJob.set(jobId, pending);
+        }
+        pending.set(callId, { resolve, reject });
+        const onAbort = () => {
+            pending.delete(callId);
+            reject(new Error("aborted"));
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+/** Server-side handlers: same schemas as local tools, execution on the CLI. */
+export function remoteBridgeToolHandlers(jobId, signal, allowedNames, sourceHandlers) {
+    const byName = new Map(sourceHandlers.map((handler) => [handler.name, handler]));
+    const handlers = [];
+    for (const name of allowedNames) {
+        if (name === "read-full-diff" || !REMOTE_KNOWN_TOOL_NAMES.has(name)) {
+            continue;
+        }
+        const src = byName.get(name);
+        if (!src)
+            continue;
+        handlers.push({
+            name: src.name,
+            tool: src.tool,
+            run: (args) => queueToolCall(jobId, signal, src.name, args),
+        });
+    }
+    return handlers;
+}

package/dist/src/remote/validate.d.ts

@@ -0,0 +1,8 @@
+export declare function parseSchemaVersion(body: Record<string, unknown>): number | string;
+export declare function assertClientSchema(version: number): string | null;
+export declare function validateRemotePath(field: string, path: string): string | null;
+export declare function validateRevisionPayload(revision: unknown): string | null;
+export declare function validateHandshakeRequest(body: unknown): string | null;
+export declare function validateSubmitRequest(body: unknown): string | null;
+export declare function validateSyncRequest(body: unknown): string | null;
+export declare function validateSyncResponseStatus(status: unknown): string | null;

package/dist/src/remote/validate.js

@@ -0,0 +1,248 @@
+import { rejectEscapingPath } from "../pr/codegraph_tool_args.js";
+import { MIN_CLIENT_SCHEMA, REMOTE_KNOWN_TOOL_NAMES, REMOTE_SCHEMA_VERSION, REMOTE_SYNC_STATUSES, } from "./schema.js";
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const REVISION_STATUSES = new Set([
+    "added",
+    "modified",
+    "removed",
+    "renamed",
+]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function bad(field, reason) {
+    return `${field}: ${reason}`;
+}
+export function parseSchemaVersion(body) {
+    const v = body.schemaVersion;
+    if (typeof v !== "number" || !Number.isInteger(v) || v < 1) {
+        return bad("schemaVersion", "must be a positive integer");
+    }
+    return v;
+}
+export function assertClientSchema(version) {
+    if (version < MIN_CLIENT_SCHEMA) {
+        return bad("schemaVersion", `must be at least ${MIN_CLIENT_SCHEMA}`);
+    }
+    if (version > REMOTE_SCHEMA_VERSION) {
+        return bad("schemaVersion", `must be at most ${REMOTE_SCHEMA_VERSION}`);
+    }
+    return null;
+}
+function validateBranch(name, value) {
+    if (!value)
+        return bad(name, "must not be empty");
+    if (value.length > 255)
+        return bad(name, "too long");
+    if (/[\0\r\n]/.test(value))
+        return bad(name, "invalid characters");
+    return null;
+}
+export function validateRemotePath(field, path) {
+    if (!path)
+        return bad(field, "must not be empty");
+    if (path.includes("\\"))
+        return bad(field, "must use forward slashes");
+    if (/[\0]/.test(path))
+        return bad(field, "invalid characters");
+    const norm = path.replace(/\\/g, "/");
+    if (norm.startsWith("/") ||
+        norm.startsWith("//") ||
+        /^[A-Za-z]:\//.test(norm) ||
+        /^[A-Za-z]:$/.test(norm) ||
+        norm.split("/").includes("..")) {
+        return bad(field, "must stay inside the repository");
+    }
+    const escape = rejectEscapingPath(path);
+    if (escape)
+        return bad(field, escape.replace(/^Tool error: /, ""));
+    return null;
+}
+function validateRevisionFile(file, index, paths) {
+    if (!isRecord(file)) {
+        return bad(`revision.files[${index}]`, "must be an object");
+    }
+    const path = file.path;
+    if (typeof path !== "string") {
+        return bad(`revision.files[${index}].path`, "must be a string");
+    }
+    const pathErr = validateRemotePath(`revision.files[${index}].path`, path);
+    if (pathErr)
+        return pathErr;
+    if (paths.has(path)) {
+        return bad(`revision.files[${index}].path`, "duplicate path");
+    }
+    paths.add(path);
+    const status = file.status;
+    if (typeof status !== "string" ||
+        !REVISION_STATUSES.has(status)) {
+        return bad(`revision.files[${index}].status`, "invalid status");
+    }
+    const previousPath = file.previousPath;
+    if (previousPath !== null && previousPath !== undefined) {
+        if (typeof previousPath !== "string") {
+            return bad(`revision.files[${index}].previousPath`, "must be a string or null");
+        }
+        const prevErr = validateRemotePath(`revision.files[${index}].previousPath`, previousPath);
+        if (prevErr)
+            return prevErr;
+    }
+    if (status === "renamed") {
+        if (typeof previousPath !== "string" || !previousPath) {
+            return bad(`revision.files[${index}].previousPath`, "required for renamed");
+        }
+    }
+    const binary = file.binary;
+    if (typeof binary !== "boolean") {
+        return bad(`revision.files[${index}].binary`, "must be a boolean");
+    }
+    const patch = file.patch;
+    if (typeof patch !== "string") {
+        return bad(`revision.files[${index}].patch`, "must be a string");
+    }
+    if (binary && patch.length > 0) {
+        return bad(`revision.files[${index}].patch`, "must be empty for binary files");
+    }
+    for (const key of ["additions", "deletions"]) {
+        const n = file[key];
+        if (typeof n !== "number" || !Number.isInteger(n) || n < 0) {
+            return bad(`revision.files[${index}].${key}`, "must be a non-negative integer");
+        }
+    }
+    return null;
+}
+export function validateRevisionPayload(revision) {
+    if (!isRecord(revision))
+        return bad("revision", "required");
+    const files = revision.files;
+    if (!Array.isArray(files) || files.length < 1) {
+        return bad("revision.files", "must have at least one file");
+    }
+    const paths = new Set();
+    for (let i = 0; i < files.length; i++) {
+        const err = validateRevisionFile(files[i], i, paths);
+        if (err)
+            return err;
+    }
+    return null;
+}
+export function validateHandshakeRequest(body) {
+    if (!isRecord(body))
+        return "body must be an object";
+    const version = parseSchemaVersion(body);
+    if (typeof version === "string")
+        return version;
+    const schemaErr = assertClientSchema(version);
+    if (schemaErr)
+        return schemaErr;
+    if (typeof body.clientVersion !== "string" || !body.clientVersion) {
+        return bad("clientVersion", "required");
+    }
+    if (typeof body.repo !== "string" || !body.repo.includes("/")) {
+        return bad("repo", "must be owner/repo");
+    }
+    return null;
+}
+export function validateSubmitRequest(body) {
+    if (!isRecord(body))
+        return "body must be an object";
+    const version = parseSchemaVersion(body);
+    if (typeof version === "string")
+        return version;
+    const schemaErr = assertClientSchema(version);
+    if (schemaErr)
+        return schemaErr;
+    const requestId = body.requestId;
+    if (typeof requestId !== "string" || !UUID_RE.test(requestId)) {
+        return bad("requestId", "must be a UUID");
+    }
+    if (typeof body.repo !== "string" || !body.repo) {
+        return bad("repo", "required");
+    }
+    if (typeof body.branch !== "string") {
+        return bad("branch", "must be a string");
+    }
+    const branchErr = validateBranch("branch", body.branch);
+    if (branchErr)
+        return branchErr;
+    if (body.toBranch !== undefined && typeof body.toBranch !== "string") {
+        return bad("toBranch", "must be a string");
+    }
+    if (body.fresh !== undefined && typeof body.fresh !== "boolean") {
+        return bad("fresh", "must be a boolean");
+    }
+    const revisionErr = validateRevisionPayload(body.revision);
+    if (revisionErr)
+        return revisionErr;
+    if (body.capabilities !== undefined) {
+        if (!isRecord(body.capabilities)) {
+            return bad("capabilities", "must be an object");
+        }
+        const tools = body.capabilities.tools;
+        if (tools !== undefined) {
+            if (!Array.isArray(tools))
+                return bad("capabilities.tools", "must be an array");
+            for (let i = 0; i < tools.length; i++) {
+                const tool = tools[i];
+                if (!isRecord(tool)) {
+                    return bad(`capabilities.tools[${i}]`, "must be an object");
+                }
+                if (typeof tool.name !== "string" || !tool.name) {
+                    return bad(`capabilities.tools[${i}].name`, "required");
+                }
+                // Unknown tools are ignored at runtime; no error here (plan §14.5).
+                if (REMOTE_KNOWN_TOOL_NAMES.has(tool.name) &&
+                    tool.version !== undefined &&
+                    typeof tool.version !== "string") {
+                    return bad(`capabilities.tools[${i}].version`, "must be a string");
+                }
+            }
+        }
+    }
+    return null;
+}
+export function validateSyncRequest(body) {
+    if (!isRecord(body))
+        return "body must be an object";
+    const version = parseSchemaVersion(body);
+    if (typeof version === "string")
+        return version;
+    const schemaErr = assertClientSchema(version);
+    if (schemaErr)
+        return schemaErr;
+    const after = body.afterLogSeq;
+    if (typeof after !== "number" || !Number.isInteger(after) || after < 0) {
+        return bad("afterLogSeq", "must be a non-negative integer");
+    }
+    const results = body.toolResults;
+    if (results !== undefined) {
+        if (!Array.isArray(results))
+            return bad("toolResults", "must be an array");
+        for (let i = 0; i < results.length; i++) {
+            const row = results[i];
+            if (!isRecord(row)) {
+                return bad(`toolResults[${i}]`, "must be an object");
+            }
+            if (typeof row.callId !== "string" || !row.callId) {
+                return bad(`toolResults[${i}].callId`, "required");
+            }
+            const hasOut = row.output !== undefined;
+            const hasErr = row.error !== undefined;
+            if (hasOut && typeof row.output !== "string") {
+                return bad(`toolResults[${i}].output`, "must be a string");
+            }
+            if (hasErr && typeof row.error !== "string") {
+                return bad(`toolResults[${i}].error`, "must be a string");
+            }
+        }
+    }
+    return null;
+}
+export function validateSyncResponseStatus(status) {
+    if (typeof status !== "string")
+        return bad("status", "required");
+    if (!REMOTE_SYNC_STATUSES.includes(status)) {
+        return bad("status", "unexpected value");
+    }
+    return null;
+}